TJ MAXX Update : Weak Wi-Fi Encryption (WEP) To Blame For The Security BreachBest Security Tips offers daily news, information, advices and tips about spyware, adware, viruses, trojans, web vulnerabilities, hackers, other threats    | Register now | Login
   
   
TIPS NEWS TOOLS DOWNLOADS MALWARE FORUM BOOKS FREE MAGAZINES SECURITY & PRIVACY
GFI WebMonitor, Internet content filtering tool for SMBs. Download free trial now! 
Bookmark and Share 
Best Tips
Security Scanner
Security Categories
Reccomendations
Latest Viruses / Threats
Advertise With Us !
Downloads
VyprVPN
VyprVPN Personal VPN lets you browse securely
Security Incidents : TJ MAXX Update : Weak Wi-Fi Encryption (WEP) To Blame For The Security Breach
Posted by Max on 2007/5/7 10:50:18 (12026 reads)
Security Incidents

It appears that the root of all evil in TJ MAXX Marshalls security breach was the use of weak encryption (WEP) in† wireless access points. Despite a market capitalization of almost $13bn, the company apparently couldn't afford to secure its Wi-Fi network with anything more robust than the sadly inadequate Wired Equivalent Privacy (WEP) protocol. (The much more secure Wi-Fi Protected Access has become standard on most routers for four years now.)

A wireless network that employed less security than many people use on their home systems seems to be the weak link that led TJX Companies, the US-based retailing empire, to preside over the world's biggest known theft of credit-card numbers.


The company also failed to use firewalls or install software patches and ignored requirements imposed by Visa and MasterCard concerning how card information is stored and transmitted.

According to a front-page article in today's Wall Street Journal, the misconfiguration† allowed hackers to use a simple telescope-shaped antenna and a laptop to intercept data flowing through a Wi-Fi network used at a Marshalls discount clothing store near St. Paul, Minnesota.

"It was as easy as breaking into a house through a side window that was wide open," a person familiar with the investigation told the Journal.

The hackers, who bore the hallmarks of Romanian gangs and Russian organized crime groups, were able to eavesdrop on employees logging into TJX's central server in Framingham, Massachusetts, where the hackers eventually were able to set up their own accounts. From then on, they were able to log onto the system remotely, from anywhere in the world.

The trespassers blatantly used the network as a communication post, leaving each other encrypted messages so one wouldn't duplicate the work of another. They also may have lifted card information that was being processed over the network, taking advantage of TJX's failure to use encryption when transmitting the data, as required by credit-card company guidelines.

TJX has fessed up to losing 45.7m credit and debit card numbers and personal information relating to almost 500,000 people. But according to one person, the thieves may have stolen as many as 200m accounts. (TJX rejects that claim as "speculation.")

Stolen card numbers have been used in at least seven US states and at least eight countries, including Mexico, China, Italy, Australia and Japan. In one case, police in Florida charged a single gang with using hacked TJX card data to steal $8m in transactions at Wal-Mart Stores and other outlets.

All told, the breach could cost TJX $1bn over five years in costs for consultants, security upgrades, attorney fees and damage-control marketing, analysts from Forrester Research estimate.

Significantly, Forrester's estimate doesn't include liabilities that may result from lawsuits, such as one recently filed by associations representing almost 300 Northeastern banks in the US.

Plenty of banks have been saddled with costs resulting from the breach. Banking associates are lobbying federal and state lawmakers for legislation that would require companies who suffer security breaches to absorb the costs of issuing new credit cards.




Other articles
2013/1/31 3:00:00 - Your Tax Refund Is The Identity Theft's Taxing New Trend
2013/1/31 2:40:00 - zvelo Releases New Technology For Detecting Spam Web Pages
2013/1/30 2:33:29 - Next-Generation Secure Internet Gateway for K-12 Released By ContentKeeper
2013/1/30 2:28:57 - Zscaler Offers Single Sign-On For Its Cloud Application Security
2013/1/25 3:40:00 - Bitdefender Focuses on Privacy Awareness
2013/1/19 5:20:00 - Comodo 2013 Internet Security Includes Default Deny Protection
2013/1/18 5:10:00 - Romanian Citizen Convicted to Four Years in Prison For Phishing
2013/1/16 5:02:01 - Sophos Listed For Best Malware Detection Rates on the Market Today in New Security Report
2013/1/16 4:57:27 - Symantecís 2012 Information Retention and eDiscovery Survey
2013/1/16 4:48:33 - PC Magazine awards Best of 2012 Soft to Panda Cloud Antivirus

The comments are owned by the poster. We aren't responsible for their content.